Reading non-ociv1 image configs is lossy #1

nalind · 2017-01-31T18:41:58Z

Right now the tool assumes that image configurations can be decoded as OCI image-spec v1 Image objects. If the source image is anything else, we lose information this way.

nalind · 2017-02-24T21:13:20Z

We should be able to read github.com/docker/docker/image.Image configuration blobs now. There's some information in manifests that decode as github.com/containers/image/image.manifestSchema1 in images like kubernetes/pause where we don't have a config blob, and we might have to try fishing around in the manifest for them.

rhatdan · 2017-04-21T13:16:01Z

Is this issue still present?

nalind · 2017-05-01T15:09:46Z

We handle images that include config blobs (version 2, schema 2), but we still don't support digging around in (version 2, schema 1) images.

nalind · 2017-06-02T19:47:33Z

As of #118, we should be handling v2 schema 1 images, so I think we can finally close this one.

Initial checkin

This subtle bug keeps lurking in because error checking for `Mkdir()` and `MkdirAll()` is slightly different wrt `EEXIST`/`IsExist`: - for `Mkdir()`, `IsExist` error should (usually) be ignored (unless you want to make sure directory was not there before) as it means "the destination directory was already there"; - for `MkdirAll()`, `IsExist` error should NEVER be ignored. This commit removes ignoring the IsExist error, as it should not be ignored. For more details, a quote from opencontainers/runc PR containers#162: -quote- TL;DR: check for IsExist(err) after a failed MkdirAll() is both redundant and wrong -- so two reasons to remove it. Quoting MkdirAll documentation: > MkdirAll creates a directory named path, along with any necessary > parents, and returns nil, or else returns an error. If path > is already a directory, MkdirAll does nothing and returns nil. This means two things: 1. If a directory to be created already exists, no error is returned. 2. If the error returned is IsExist (EEXIST), it means there exists a non-directory with the same name as MkdirAll need to use for directory. Example: we want to MkdirAll("a/b"), but file "a" (or "a/b") already exists, so MkdirAll fails. The above is a theory, based on quoted documentation and my UNIX knowledge. 3. In practice, though, current MkdirAll implementation [1] returns ENOTDIR in most of cases described in containers#2, with the exception when there is a race between MkdirAll and someone else creating the last component of MkdirAll argument as a file. In this very case MkdirAll() will indeed return EEXIST. Because of containers#1, IsExist check after MkdirAll is not needed. Because of containers#2 and containers#3, ignoring IsExist error is just plain wrong, as directory we require is not created. It's cleaner to report the error now. Note this error is all over the tree, I guess due to copy-paste, or trying to follow the same usage pattern as for Mkdir(), or some not quite correct examples on the Internet. > [1] https://github.com/golang/go/blob/f9ed2f75/src/os/path.go -end-quote- Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

2396: Bump github.com/containers/storage from 1.20.1 to 1.20.2 r=rhatdan a=dependabot-preview[bot] Bumps [github.com/containers/storage](https://github.com/containers/storage) from 1.20.1 to 1.20.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/containers/storage/releases">github.com/containers/storage's releases</a>.</em></p> <blockquote> <h2>v1.20.2</h2> <pre><code>Add back skip_mount_home Update git validation EPOCH build(deps): bump github.com/opencontainers/runc from 1.0.0-rc9 to 1.0.0-rc90 build(deps): bump github.com/klauspost/compress from 1.10.5 to 1.10.7 build(deps): bump github.com/stretchr/testify from 1.5.1 to 1.6.0 unbreak build on mipsen </code></pre> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/containers/storage/commit/e43b6d0a370bf26e3147f3ab10fad29cc25620f9"><code>e43b6d0</code></a> Bump to v1.20.2</li> <li><a href="https://github.com/containers/storage/commit/80f21246e8e6ec24acf10a2d083573ed55b4c60f"><code>80f2124</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/containers/storage/issues/639">#639</a> from rhatdan/skip</li> <li><a href="https://github.com/containers/storage/commit/0bfdcdb942abc97a6f9c3a63c4c4b77dc849450b"><code>0bfdcdb</code></a> Add back skip_mount_home</li> <li><a href="https://github.com/containers/storage/commit/aa26d1860a7ab2f1a79c79d9beac8ab01c9a64a0"><code>aa26d18</code></a> Update git validation EPOCH</li> <li><a href="https://github.com/containers/storage/commit/8fad529da3a4e5dbcb3f1fc1bc009bc857a4968b"><code>8fad529</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/containers/storage/issues/637">#637</a> from containers/dependabot/go_modules/github.com/klau...</li> <li><a href="https://github.com/containers/storage/commit/17acc0ffa10e07fd71a8d84161e269564b72b90d"><code>17acc0f</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/containers/storage/issues/638">#638</a> from containers/dependabot/go_modules/github.com/open...</li> <li><a href="https://github.com/containers/storage/commit/24e8e852d0dc09a1cef1ebe9a20446c83129470a"><code>24e8e85</code></a> build(deps): bump github.com/opencontainers/runc</li> <li><a href="https://github.com/containers/storage/commit/b9dafa698726b5f070599dde6038999cf62c83c2"><code>b9dafa6</code></a> build(deps): bump github.com/klauspost/compress from 1.10.6 to 1.10.7</li> <li><a href="https://github.com/containers/storage/commit/873116d157fad490a878cdfd0277dc3fc0c34950"><code>873116d</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/containers/storage/issues/636">#636</a> from containers/dependabot/go_modules/github.com/stre...</li> <li><a href="https://github.com/containers/storage/commit/0a7c48440c25ec26b4a710c03c957e665f4b2649"><code>0a7c484</code></a> build(deps): bump github.com/stretchr/testify from 1.5.1 to 1.6.0</li> <li>Additional commits viewable in <a href="https://github.com/containers/storage/compare/v1.20.1...v1.20.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=github.com/containers/storage&package-manager=go_modules&previous-version=1.20.1&new-version=1.20.2)](https://dependabot.com/compatibility-score/?dependency-name=github.com/containers/storage&package-manager=go_modules&previous-version=1.20.1&new-version=1.20.2) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired) </details> 2397: Bump github.com/opencontainers/runc from 1.0.0-rc9 to 1.0.0-rc90 r=rhatdan a=dependabot-preview[bot] Bumps [github.com/opencontainers/runc](https://github.com/opencontainers/runc) from 1.0.0-rc9 to 1.0.0-rc90. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/opencontainers/runc/releases">github.com/opencontainers/runc's releases</a>.</em></p> <blockquote> <h2>runc 1.0-rc90 -- "We Have To Go Back!"</h2> <p>This release is <em>identical</em> to v1.0.0-rc10 (and thus the version string in the binary will be v1.0.0-rc10).</p> <p>The purpose of this release is to resolve an issue with our versioning scheme (in particular, the format we've used under SemVer means that the "-rcNN" string suffix is sorted lexicographically rather than in the classic <code>sort -V</code> order).</p> <p>Because we cannot do a post-1.0 release yet, this is a workaround to make sure that systems such as Go modules correctly update to the latest runc release. See <a href="https://github-redirect.dependabot.com/opencontainers/runc/issues/2399">#2399</a> for more details.</p> <p>The next release (which would've originally been called -rc11) will be 1.0.0-rc91. I'm sorry.</p> <p>Signed-off-by: Aleksa Sarai <a href="mailto:asarai@suse.de">asarai@suse.de</a></p> <h2>runc 1.0-rc10 -- "Procfs Strikes Back"</h2> <p>This is a hot-fix for v1.0.0~rc9, primarily fixing CVE-2019-19921. Given that the <a href="https://github-redirect.dependabot.com/opencontainers/runtime-spec/pull/1008">relevant runtime-spec PR which was considered a blocker has been merged</a> the next rc release of runc should be the last one before 1.0.0.</p> <p>Other notable changes include:</p> <ul> <li>Fixing an exec-fifo race that could be triggered under Kubernetes (opencontainers/runc#2185).</li> <li>Partial cgroupv2 support (opencontainers/runc#2209 for remaining issues).</li> </ul> <p>Thanks to the following people who made this release possible:</p> <ul> <li>Akihiro Suda <a href="mailto:akihiro.suda.cz@hco.ntt.co.jp">akihiro.suda.cz@hco.ntt.co.jp</a></li> <li>Aleksa Sarai <a href="mailto:asarai@suse.de">asarai@suse.de</a></li> <li>James Peach <a href="mailto:jpeach@apache.org">jpeach@apache.org</a></li> <li>Jordan Liggitt <a href="mailto:liggitt@google.com">liggitt@google.com</a></li> <li>Julia Nedialkova <a href="mailto:julianedialkova@hotmail.com">julianedialkova@hotmail.com</a></li> <li>Julio Montes <a href="mailto:julio.montes@intel.com">julio.montes@intel.com</a></li> <li>Kevin Kelani <a href="mailto:kkelani@gmail.com">kkelani@gmail.com</a></li> <li>Kurnia D Win <a href="mailto:kurnia.d.win@gmail.com">kurnia.d.win@gmail.com</a></li> <li>Manuel Rüger <a href="mailto:manuel@rueg.eu">manuel@rueg.eu</a></li> <li>Michael Crosby <a href="mailto:crosbymichael@gmail.com">crosbymichael@gmail.com</a></li> <li>Mrunal Patel <a href="mailto:mrunal@me.com">mrunal@me.com</a></li> <li>Qiang Huang <a href="mailto:h.huangqiang@huawei.com">h.huangqiang@huawei.com</a></li> <li>Radostin Stoyanov <a href="mailto:rstoyanov1@gmail.com">rstoyanov1@gmail.com</a></li> <li>Sascha Grunert <a href="mailto:sgrunert@suse.com">sgrunert@suse.com</a></li> <li>tianye15 <a href="mailto:tianye15@yq01-ps-www007cc6e83.yq01.baidu.com">tianye15@yq01-ps-www007cc6e83.yq01.baidu.com</a></li> </ul> <p>Vote: <code>+4 -0 [#1](https://github.com/opencontainers/runc/issues/1)</code> Signed-off-by: Aleksa Sarai <a href="mailto:asarai@suse.de">asarai@suse.de</a></p> </tr></table> ... (truncated) </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/opencontainers/runc/commit/dc9208a3303feef5b3839f4323d9beb36df0a9dd"><code>dc9208a</code></a> VERSION: update to 1.0.0~rc10</li> <li><a href="https://github.com/opencontainers/runc/commit/2fc03cc11c775b7a8b2e48d7ee447cb9bef32ad0"><code>2fc03cc</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/opencontainers/runc/issues/2207">#2207</a> from cyphar/fix-double-volume-attack</li> <li><a href="https://github.com/opencontainers/runc/commit/3291d66b98445bd7f7d02eac7f2bca2ac2c56942"><code>3291d66</code></a> rootfs: do not permit /proc mounts to non-directories</li> <li><a href="https://github.com/opencontainers/runc/commit/f6fb7a0338c3ea8488bd9bd7cc7667b113aff8d8"><code>f6fb7a0</code></a> merge branch 'pr-2133'</li> <li><a href="https://github.com/opencontainers/runc/commit/709377ca558df88ea538852c9310b700f140fc9b"><code>709377c</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/opencontainers/runc/issues/2198">#2198</a> from AkihiroSuda/criu-master</li> <li><a href="https://github.com/opencontainers/runc/commit/55f8c254beb00f916c115a7034f7eee0cfd657a1"><code>55f8c25</code></a> temporarily disable CRIU tests</li> <li><a href="https://github.com/opencontainers/runc/commit/5c20ea1472dbeeebdb1bcef31a09888890a25b3a"><code>5c20ea1</code></a> fix merging <a href="https://github-redirect.dependabot.com/opencontainers/runc/issues/2177">#2177</a> and <a href="https://github-redirect.dependabot.com/opencontainers/runc/issues/2169">#2169</a></li> <li><a href="https://github.com/opencontainers/runc/commit/5cc0deaf7a089a91a5ce4b81f835b64fcc4778d6"><code>5cc0dea</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/opencontainers/runc/issues/2169">#2169</a> from AkihiroSuda/split-fs</li> <li><a href="https://github.com/opencontainers/runc/commit/2b52db75279ca687e18156de86d845876e9ef35d"><code>2b52db7</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/opencontainers/runc/issues/2177">#2177</a> from devimc/topic/libcontainer/kata-containers</li> <li><a href="https://github.com/opencontainers/runc/commit/a88592a63474e6976030b4fbded41dd445152236"><code>a88592a</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/opencontainers/runc/issues/2185">#2185</a> from liggitt/exec-race</li> <li>Additional commits viewable in <a href="https://github.com/opencontainers/runc/compare/v1.0.0-rc9...v1.0.0-rc90">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=github.com/opencontainers/runc&package-manager=go_modules&previous-version=1.0.0-rc9&new-version=1.0.0-rc90)](https://dependabot.com/compatibility-score/?dependency-name=github.com/opencontainers/runc&package-manager=go_modules&previous-version=1.0.0-rc9&new-version=1.0.0-rc90) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired) </details> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>

2397: Bump github.com/opencontainers/runc from 1.0.0-rc9 to 1.0.0-rc90 r=rhatdan a=dependabot-preview[bot] Bumps [github.com/opencontainers/runc](https://github.com/opencontainers/runc) from 1.0.0-rc9 to 1.0.0-rc90. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/opencontainers/runc/releases">github.com/opencontainers/runc's releases</a>.</em></p> <blockquote> <h2>runc 1.0-rc90 -- "We Have To Go Back!"</h2> <p>This release is <em>identical</em> to v1.0.0-rc10 (and thus the version string in the binary will be v1.0.0-rc10).</p> <p>The purpose of this release is to resolve an issue with our versioning scheme (in particular, the format we've used under SemVer means that the "-rcNN" string suffix is sorted lexicographically rather than in the classic <code>sort -V</code> order).</p> <p>Because we cannot do a post-1.0 release yet, this is a workaround to make sure that systems such as Go modules correctly update to the latest runc release. See <a href="https://github-redirect.dependabot.com/opencontainers/runc/issues/2399">#2399</a> for more details.</p> <p>The next release (which would've originally been called -rc11) will be 1.0.0-rc91. I'm sorry.</p> <p>Signed-off-by: Aleksa Sarai <a href="mailto:asarai@suse.de">asarai@suse.de</a></p> <h2>runc 1.0-rc10 -- "Procfs Strikes Back"</h2> <p>This is a hot-fix for v1.0.0~rc9, primarily fixing CVE-2019-19921. Given that the <a href="https://github-redirect.dependabot.com/opencontainers/runtime-spec/pull/1008">relevant runtime-spec PR which was considered a blocker has been merged</a> the next rc release of runc should be the last one before 1.0.0.</p> <p>Other notable changes include:</p> <ul> <li>Fixing an exec-fifo race that could be triggered under Kubernetes (opencontainers/runc#2185).</li> <li>Partial cgroupv2 support (opencontainers/runc#2209 for remaining issues).</li> </ul> <p>Thanks to the following people who made this release possible:</p> <ul> <li>Akihiro Suda <a href="mailto:akihiro.suda.cz@hco.ntt.co.jp">akihiro.suda.cz@hco.ntt.co.jp</a></li> <li>Aleksa Sarai <a href="mailto:asarai@suse.de">asarai@suse.de</a></li> <li>James Peach <a href="mailto:jpeach@apache.org">jpeach@apache.org</a></li> <li>Jordan Liggitt <a href="mailto:liggitt@google.com">liggitt@google.com</a></li> <li>Julia Nedialkova <a href="mailto:julianedialkova@hotmail.com">julianedialkova@hotmail.com</a></li> <li>Julio Montes <a href="mailto:julio.montes@intel.com">julio.montes@intel.com</a></li> <li>Kevin Kelani <a href="mailto:kkelani@gmail.com">kkelani@gmail.com</a></li> <li>Kurnia D Win <a href="mailto:kurnia.d.win@gmail.com">kurnia.d.win@gmail.com</a></li> <li>Manuel Rüger <a href="mailto:manuel@rueg.eu">manuel@rueg.eu</a></li> <li>Michael Crosby <a href="mailto:crosbymichael@gmail.com">crosbymichael@gmail.com</a></li> <li>Mrunal Patel <a href="mailto:mrunal@me.com">mrunal@me.com</a></li> <li>Qiang Huang <a href="mailto:h.huangqiang@huawei.com">h.huangqiang@huawei.com</a></li> <li>Radostin Stoyanov <a href="mailto:rstoyanov1@gmail.com">rstoyanov1@gmail.com</a></li> <li>Sascha Grunert <a href="mailto:sgrunert@suse.com">sgrunert@suse.com</a></li> <li>tianye15 <a href="mailto:tianye15@yq01-ps-www007cc6e83.yq01.baidu.com">tianye15@yq01-ps-www007cc6e83.yq01.baidu.com</a></li> </ul> <p>Vote: <code>+4 -0 [#1](https://github.com/opencontainers/runc/issues/1)</code> Signed-off-by: Aleksa Sarai <a href="mailto:asarai@suse.de">asarai@suse.de</a></p> </tr></table> ... (truncated) </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/opencontainers/runc/commit/dc9208a3303feef5b3839f4323d9beb36df0a9dd"><code>dc9208a</code></a> VERSION: update to 1.0.0~rc10</li> <li><a href="https://github.com/opencontainers/runc/commit/2fc03cc11c775b7a8b2e48d7ee447cb9bef32ad0"><code>2fc03cc</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/opencontainers/runc/issues/2207">#2207</a> from cyphar/fix-double-volume-attack</li> <li><a href="https://github.com/opencontainers/runc/commit/3291d66b98445bd7f7d02eac7f2bca2ac2c56942"><code>3291d66</code></a> rootfs: do not permit /proc mounts to non-directories</li> <li><a href="https://github.com/opencontainers/runc/commit/f6fb7a0338c3ea8488bd9bd7cc7667b113aff8d8"><code>f6fb7a0</code></a> merge branch 'pr-2133'</li> <li><a href="https://github.com/opencontainers/runc/commit/709377ca558df88ea538852c9310b700f140fc9b"><code>709377c</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/opencontainers/runc/issues/2198">#2198</a> from AkihiroSuda/criu-master</li> <li><a href="https://github.com/opencontainers/runc/commit/55f8c254beb00f916c115a7034f7eee0cfd657a1"><code>55f8c25</code></a> temporarily disable CRIU tests</li> <li><a href="https://github.com/opencontainers/runc/commit/5c20ea1472dbeeebdb1bcef31a09888890a25b3a"><code>5c20ea1</code></a> fix merging <a href="https://github-redirect.dependabot.com/opencontainers/runc/issues/2177">#2177</a> and <a href="https://github-redirect.dependabot.com/opencontainers/runc/issues/2169">#2169</a></li> <li><a href="https://github.com/opencontainers/runc/commit/5cc0deaf7a089a91a5ce4b81f835b64fcc4778d6"><code>5cc0dea</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/opencontainers/runc/issues/2169">#2169</a> from AkihiroSuda/split-fs</li> <li><a href="https://github.com/opencontainers/runc/commit/2b52db75279ca687e18156de86d845876e9ef35d"><code>2b52db7</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/opencontainers/runc/issues/2177">#2177</a> from devimc/topic/libcontainer/kata-containers</li> <li><a href="https://github.com/opencontainers/runc/commit/a88592a63474e6976030b4fbded41dd445152236"><code>a88592a</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/opencontainers/runc/issues/2185">#2185</a> from liggitt/exec-race</li> <li>Additional commits viewable in <a href="https://github.com/opencontainers/runc/compare/v1.0.0-rc9...v1.0.0-rc90">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=github.com/opencontainers/runc&package-manager=go_modules&previous-version=1.0.0-rc9&new-version=1.0.0-rc90)](https://dependabot.com/compatibility-score/?dependency-name=github.com/opencontainers/runc&package-manager=go_modules&previous-version=1.0.0-rc9&new-version=1.0.0-rc90) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired) </details> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>

This subtle bug keeps lurking in because error checking for `Mkdir()` and `MkdirAll()` is slightly different wrt `EEXIST`/`IsExist`: - for `Mkdir()`, `IsExist` error should (usually) be ignored (unless you want to make sure directory was not there before) as it means "the destination directory was already there"; - for `MkdirAll()`, `IsExist` error should NEVER be ignored. This commit removes ignoring the IsExist error, as it should not be ignored. [v2: skip patching (*Builder).Run] For more details, a quote from opencontainers/runc PR containers#162: -quote- TL;DR: check for IsExist(err) after a failed MkdirAll() is both redundant and wrong -- so two reasons to remove it. Quoting MkdirAll documentation: > MkdirAll creates a directory named path, along with any necessary > parents, and returns nil, or else returns an error. If path > is already a directory, MkdirAll does nothing and returns nil. This means two things: 1. If a directory to be created already exists, no error is returned. 2. If the error returned is IsExist (EEXIST), it means there exists a non-directory with the same name as MkdirAll need to use for directory. Example: we want to MkdirAll("a/b"), but file "a" (or "a/b") already exists, so MkdirAll fails. The above is a theory, based on quoted documentation and my UNIX knowledge. 3. In practice, though, current MkdirAll implementation [1] returns ENOTDIR in most of cases described in containers#2, with the exception when there is a race between MkdirAll and someone else creating the last component of MkdirAll argument as a file. In this very case MkdirAll() will indeed return EEXIST. Because of containers#1, IsExist check after MkdirAll is not needed. Because of containers#2 and containers#3, ignoring IsExist error is just plain wrong, as directory we require is not created. It's cleaner to report the error now. Note this error is all over the tree, I guess due to copy-paste, or trying to follow the same usage pattern as for Mkdir(), or some not quite correct examples on the Internet. > [1] https://github.com/golang/go/blob/f9ed2f75/src/os/path.go -end-quote- Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

This subtle bug keeps lurking in because error checking for `Mkdir()` and `MkdirAll()` is slightly different wrt `EEXIST`/`IsExist`: - for `Mkdir()`, `IsExist` error should (usually) be ignored (unless you want to make sure directory was not there before) as it means "the destination directory was already there"; - for `MkdirAll()`, `IsExist` error should NEVER be ignored. This commit removes ignoring the IsExist error, as it should not be ignored. [v2: skip patching (*Builder).Run] For more details, a quote from opencontainers/runc PR #162: -quote- TL;DR: check for IsExist(err) after a failed MkdirAll() is both redundant and wrong -- so two reasons to remove it. Quoting MkdirAll documentation: > MkdirAll creates a directory named path, along with any necessary > parents, and returns nil, or else returns an error. If path > is already a directory, MkdirAll does nothing and returns nil. This means two things: 1. If a directory to be created already exists, no error is returned. 2. If the error returned is IsExist (EEXIST), it means there exists a non-directory with the same name as MkdirAll need to use for directory. Example: we want to MkdirAll("a/b"), but file "a" (or "a/b") already exists, so MkdirAll fails. The above is a theory, based on quoted documentation and my UNIX knowledge. 3. In practice, though, current MkdirAll implementation [1] returns ENOTDIR in most of cases described in #2, with the exception when there is a race between MkdirAll and someone else creating the last component of MkdirAll argument as a file. In this very case MkdirAll() will indeed return EEXIST. Because of #1, IsExist check after MkdirAll is not needed. Because of #2 and #3, ignoring IsExist error is just plain wrong, as directory we require is not created. It's cleaner to report the error now. Note this error is all over the tree, I guess due to copy-paste, or trying to follow the same usage pattern as for Mkdir(), or some not quite correct examples on the Internet. > [1] https://github.com/golang/go/blob/f9ed2f75/src/os/path.go -end-quote- Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

nalind closed this as completed Jun 2, 2017

TomSweeneyRedHat mentioned this issue Aug 3, 2017

Issues with Centos/ version 3.* Kernels #240

Closed

nalind pushed a commit that referenced this issue Nov 28, 2017

Merge pull request #1 from mheon/master

f5019df

Initial checkin

pixdrift mentioned this issue Mar 31, 2018

Regression in storage driver support 0.11 -> 0.12 #547

Closed

kbaegis mentioned this issue Jun 24, 2018

BUD Conversion from ARG to ENV failing #813

Closed

Spindel mentioned this issue Jul 20, 2018

error creating new mount namespace #875

Closed

bowlofeggs mentioned this issue Sep 25, 2018

podman build tags images in the local registry with a leading localhost/ and docker does not #1034

Closed

TomSweeneyRedHat mentioned this issue Jan 9, 2019

Pulls from quay.io don't show progress appropriately. #1270

Closed

ghost mentioned this issue Apr 30, 2019

Buildah fails on OpenShift with anyuid disabled #1563

Closed

rhatdan mentioned this issue Oct 2, 2019

Update c/image to v4.0.1 #1891

Closed

mderoy mentioned this issue Nov 1, 2019

buildah bud needs --init option to workaround pid 1 issue during dockerfile build #1961

Closed

smothiki mentioned this issue Mar 13, 2020

Buildah failing to pull large docker images with error storing to blob file #2224

Closed

aadeshpa mentioned this issue Mar 26, 2020

Tls verification for buildah command #2251

Closed

kolyshkin mentioned this issue May 16, 2020

fix MkdirAll usage #2361

Closed

pabloyoyoista mentioned this issue May 24, 2020

buildah bud pushing wrong mediaType for compressed layers #2374

Closed

xiaotuanyu120 mentioned this issue Jun 8, 2020

max_user_namespaces not enable warn when set up environment not start with user namespace #2393

Closed

ketank-new mentioned this issue Aug 26, 2020

running a container based on buildah image on docker host #1802

Closed

jandroav mentioned this issue Oct 10, 2020

buildah copy. error checking on source. no such file or directory #2685

Closed

jarcher mentioned this issue Dec 2, 2020

running scratchmnt=$(buildah mount $newcontainer) in intro tutorial fails #2833

Closed

kirbyzhou mentioned this issue Jan 26, 2021

Cannot build any image inside rootless podman #2935

Closed

ebiederm mentioned this issue Mar 10, 2021

Missing FCAP I fail to install httpd into Fedora 33 container in build-using-dockerfile #3071

Closed

quantum77 mentioned this issue May 25, 2021

Commit "Permission denied" #3254

Closed

mfblair mentioned this issue Sep 24, 2021

Buildah failed to build image with additionalimage options #2359

Closed

gshanemiller mentioned this issue Oct 1, 2021

Rootless: permission denied adding .tar file #3563

Closed

mangelajo mentioned this issue May 11, 2022

Can create, but can't push manifest with mixed mediaTypes #3981

Open

c-linse mentioned this issue Jun 24, 2022

Multi-arch arm problem #4076

Closed

dtmdl mentioned this issue Sep 19, 2022

copier/copier.go: switch from Walk to WalkDir breaks COPY . /context from CIFS-mounted build context with symlinks #4258

Open

isavl mentioned this issue May 22, 2023

buildah build ignored mount permissions in RUN command #4811

Closed

douggutaby mentioned this issue Jun 6, 2023

overlayfs is not working on Debian host #4840

Open

github-actions bot added the locked - please file new issue/PR label Sep 23, 2023

github-actions bot locked as resolved and limited conversation to collaborators Sep 23, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Reading non-ociv1 image configs is lossy #1

Reading non-ociv1 image configs is lossy #1

nalind commented Jan 31, 2017

nalind commented Feb 24, 2017

rhatdan commented Apr 21, 2017

nalind commented May 1, 2017

nalind commented Jun 2, 2017

Reading non-ociv1 image configs is lossy #1

Reading non-ociv1 image configs is lossy #1

Comments

nalind commented Jan 31, 2017

nalind commented Feb 24, 2017

rhatdan commented Apr 21, 2017

nalind commented May 1, 2017

nalind commented Jun 2, 2017